Hackers Exploit Critical Flaw in Tencent App to Deploy Malicious Backdoor
A critical vulnerability in Tencent’s Sogou Input Method for Windows has been exploited by threat actors linked to a China-aligned espionage group, allowing them to deploy the GrayRabbit backdoor on compromised systems. This security issue is a one-click remote code execution (RCE) flaw that can be triggered by simply clicking a crafted link.
The vulnerability, identified as CVE-2026-51990, affects hundreds of millions of users in China who rely on Sogou Input Method to type Chinese characters using their standard keyboard. The app also offers a custom link handler and an outdated Chromium engine-based web browser. Researchers at Gen Digital have warned that the security issue is being actively exploited by the UNC3569 threat group to deploy the GrayRabbit backdoor.
The attack chain starts when a victim clicks on a crafted sgbiz: URI, which causes Windows to invoke Sogou’s biz_helper.exe protocol handler. This passes attacker-controlled command-line arguments to the legitimate SGMyInput.exe executable without validating them. The attacker-injected arguments then open Sogou’s skincenter component and instruct its embedded Chromium webview to load an attacker-controlled URL. Because Sogou does not restrict the URL’s scheme or destination, this allows the attacker to exploit a known vulnerability in the outdated Chromium 80 engine.
This vulnerability is particularly concerning because it allows the attackers to achieve code execution and install the GrayRabbit backdoor on compromised systems. The malware sample analyzed by Gen Digital is a more mature 64-bit variant with an expanded command set and RC4-encoded command-and-control (C2) configuration. Its capabilities include process execution, opening interactive reverse shells, uploading and downloading files, collecting system and user information, and reflectively loading plugins in the host’s memory.
Fortunately, Gen Digital reported their findings to Tencent on April 9, and the software vendor deployed a fix in Sogou Input Method version 16.3.0.3498, released on April 21. However, the researchers warned that the underlying browser remains outdated and still runs without a sandbox, with many web security protections disabled.
This incident highlights the importance of keeping software up-to-date and patching vulnerabilities in a timely manner. Users of Sogou Input Method should ensure they have installed the latest version of the app to prevent exploitation of this vulnerability. Additionally, it is essential for organizations to implement robust security measures, including regular software updates, to protect against such attacks.
As AI-powered attacks continue to evolve and become more sophisticated, defenders must stay vigilant and adapt their security strategies accordingly. By prioritizing software updates and patching vulnerabilities promptly, we can reduce the risk of these types of attacks and keep our systems secure.
Source: Bleeping Computer — 2026-09-13